| Age | Commit message (Collapse) | Author |
|---|
|
The phandles used inside a template are not copied to the node inserting
the template, leading to a missing phandle error.
The following example can be used to reproduce the issue:
&binman {
some_template: template-0 {
ti-secure-rom {
content = <&some_data>;
keyfile = "some_key";
};
some_data: blob-ext {
optional;
};
};
output-bin {
insert-template = <&some_template>;
};
};
With the error 'binman: Node '/binman/output-bin/ti-secure-rom': Cannot
find node for phandle 103' observed.
The test_copy_subnodes_from_phandles was also updated to verify the new
behavior of phandles being copied.
Reviewed-by: Moteen Shah <[email protected]>
Signed-off-by: Anshul Dalal <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
Aristo Chen <[email protected]>m says:
This series brings back the FIT load address overlap detection that
was applied to next in September 2025 and reverted a day later in
commit e482fdbbca93 ("Revert "Merge patch series "mkimage: Detect FIT
image load address overlaps and fix related test/DTS issues""").
The v2 revert had two causes. On TI AM62x family boards the tispl FIT
image references the mutually exclusive tifsstub variants at a single
shared load address, and v2 tried to satisfy the checker by moving the
variants 64 KiB apart. Neha had warned in the v1 review that this
address is fixed by the platform and that moving the images would
break tifsstub selection, and that feedback was regrettably still
unaddressed when the series was applied. Nishanth then hit exactly
this class of failure in the K3 upstream boot build with real firmware
binaries, where am62px_evm, a board v2 had not even touched, failed
the new check on tifsstub-hs and tifsstub-fs sharing 0x9ca00000.
Separately, E Shattow reported an overlap on the StarFive VisionFive
2, which we later narrowed down to OpenSBI fw_payload.bin having been
passed to the build instead of the documented fw_dynamic.bin. With
fw_dynamic.bin the board has no overlap, as confirmed on the list in
January 2026.
Since then the structural fix for the tifsstub case has landed. The
series merged as commit 4e7a9bb0885e ("Merge patch series "arm: k3:
replace tifsstub runtime filter with per-state FIT configurations"")
gives each K3 security state its own FIT configuration referencing
only the matching tifsstub variant, so a per configuration overlap
check sees no conflict while the variants keep their required common
load address. That series was written precisely to unblock this one.
The underlying semantics, that overlap is a property of a single
configuration and that images referenced by different configurations
never coexist in memory, were discussed with the FIT spec folks in
flat-image-tree issue #32 [1].
The check itself is unchanged in spirit: for every configuration,
collect the load regions of all referenced images that have both a
load address and data, and fail the build if any two regions within
that configuration intersect. Images referenced only by different
configurations may freely share addresses.
Verification done for this version:
Running the new mkimage in reprocess mode over every FIT produced by
current master builds of am62x_evm, verdin-am62 and phycore_am62x
(A53 and R5 each) flags exactly one problem: the phycore u-boot FIT,
where the four SPL devicetree overlays are loaded simultaneously from
one configuration but are spaced only 4 KiB apart while each packaged
image measures 5.9 to 6.1 KiB including its ti-secure certificate.
That is a real overlap shipping today and patch 4 widens the spacing.
All tispl FITs with the per-state tifsstub configurations pass.
buildman with binman missing blob handling, matching CI, builds all of
phycore_am62x, phycore_am62ax, phycore_am64x, am62x_evm, am62ax_evm,
am62px_evm, am64x_evm, verdin-am62, verdin-am62p and am62x_beagleplay
(A53 and R5 each) plus starfive_visionfive2 with the check active,
since binman invokes the freshly built mkimage during these builds.
starfive_visionfive2 was additionally built with a real OpenSBI 1.7
fw_dynamic.bin passed via OPENSBI and completes cleanly.
The binman functional test suite shows no new failures compared to
master in the same environment. The nine tests whose fixtures are
touched by patches 1 to 3, including the OpenSSL engine and PKCS11
signing tests that only run when softhsm2 and opensc are available,
all pass. The mkimage validation pytests, including the two new
ones, pass against a sandbox build.
[1] https://github.com/open-source-firmware/flat-image-tree/issues/32
Link: https://lore.kernel.org/r/[email protected]
|
|
The fit,load property confuses users because the load address is
taken from the ELF file rather than being specified in the binman
node. Document how to inspect an ELF file to find out where its
segments will be loaded, using readelf, the linker script or objdump,
and point at the elf_sections and elf_sections_tee test linker
scripts as examples of two components placed to avoid overlapping
memory. Also note that the mkimage load address overlap check works
on packaged data sizes and therefore assumes uncompressed images.
Compared to the previously applied version of this change, the text
now lives in the fit etype docstring. The entry documentation is
produced from docstrings by the binman_docs Sphinx extension at
documentation build time, so no pre-generated file needs updating.
Signed-off-by: Aristo Chen <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
testFitSplitElf builds both the ATF and TEE test images from the same
elf_sections binary, so the split-elf nodes generated for the two
images end up with identical load addresses and overlap in memory. An
upcoming commit teaches mkimage to validate whether the memory
regions referenced by a configuration overlap, which makes this test
fail.
Update the test to use a non-overlapping memory layout so the two
images no longer collide:
1. Add elf_sections_tee.lds, which mirrors elf_sections.lds with the
section addresses shifted up by 0x100000 for the TEE image.
2. Build an elf_sections_tee binary from it in the test Makefile.
3. Update ftest.py to use the separate ELF file for the TEE component
in split-elf operations.
Signed-off-by: Aristo Chen <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
Several binman test fixtures describe FIT images whose configuration
references both a u-boot firmware image loaded at address 0x0 with a
size of 0x2e bytes and a split-elf atf image whose first segment is
loaded at 0x10, so the two images overlap in memory. The upcoming
mkimage load address overlap check refuses to build such images,
which makes the tests that run these fixtures through mkimage fail.
Move the u-boot load and entry addresses to 0x2000, clear of the atf
segments taken from elf_sections.lds, in the fixtures used by
testFitFirmwareLoadables, testFitSignSimple,
testFitSignNoSignatureNodes, testFitSignEngineSimple,
testFitSignEncryptEngine, testFitSignPKCS11Simple,
testFitSignPKCS11Object, testFitSignMultipleKeyPaths and
testKeyNameHintIsPathSimpleFit.
Signed-off-by: Aristo Chen <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
Fix typo from `Singature` to `Signature`
Signed-off-by: Aristo Chen <[email protected]>
Reviewed-by: Dhruva Gole <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
WriteDocs() and write_bintool_docs() strip four characters from the start
of every docstring line but the first, to undo the indentation the source
file gives them. Since Python 3.13 the compiler already removes the common
indentation from docstrings [1], so this removes four characters of actual
text from every line of every entry and bintool description:
$ binman entry-docs | head
...
that an image node whose only content is an optional entry which was
is an example showing ATF, TEE and a device tree all combined::
Use inspect.cleandoc() instead, which produces the same result on both
older and newer interpreters.
The existing tests only checked that some output was produced, so they
missed this entirely; make them also confirm that a known line of a known
description survives intact.
Link: https://github.com/python/cpython/issues/81283 [1]
Signed-off-by: Alexey Charkov <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
In case the image that is wrapped in the nxp_imx8mcst already contains
an FCFB header which is mandatory for SPI NOR boot, then the IVT is at
offset 0x1000 instead of offset 0x0, but the whole image including the
FCFB header must be signed to prevent attacker from tampering with any
of the headers. Add the FCFB handling.
Signed-off-by: Marek Vasut <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
Add support for setting the CST backend, both via DT property and
CST_BACKEND environment variable. The CST currently supports two
backends, 'ssl' and 'pkcs11', with 'ssl' being the default when
CST tool is invoked without any -b parameter. Keep 'ssl' backend
as the default, but explicitly pass it via the '-b' parameter,
unless the user selects 'pkcs11' via either method.
Signed-off-by: Marek Vasut <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
U-Boot's Makefile passes KEYDIR to direct mkimage invocations, but
internal binman FIT builds only receive the generic BINMAN_INDIRS search
path. Adding KEYDIR to BINMAN_INDIRS treats it as one more input-file
search path: FIT entries still auto-detect a key directory from all
include directories, so an explicit KEYDIR may not be the directory that
gets passed to mkimage. It also makes a key-only directory part of the
generic blob lookup path.
Forward KEYDIR as a binman entry argument named keydir, matching the
existing entry-argument mechanism used for BL31, TEE, of-list and other
U-Boot build inputs. FIT entries use that directory directly for
mkimage -k when fit,sign or fit,encrypt is enabled, falling back to the
include-directory autodetection when keydir is not provided.
Signed-off-by: James Hilliard <[email protected]>
|
|
Stop depending on the current mkimage method of generating the FSPI
header, instead generate the FSPI header within binman itself. This
is more flexible, as the FSPI header properties can be configured
from within the board-specific DT instead of being hard-coded in
mkimage at build time.
Acked-by: Peng Fan <[email protected]>
Signed-off-by: Marek Vasut <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
As part of moving our git forge to a new location, update all references
in tree to point to git.u-boot-project.org now.
Signed-off-by: Tom Rini <[email protected]>
|
|
The software revision field in the combined board config binary header
was hardcoded to 1, preventing independent control from SBL SWREV
configured via ti-secure-rom's sw-rev property.
Add support for the optional 'sw-rev' DTS property in ti_board_config
nodes, which sets the SWREV byte in the header. Defaults to 1 for
backward compatibility.
Signed-off-by: Shiva Tripathi <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
|
|
patman is no longer shipped from the U-Boot tree, so drop it from the
'make pip' target and from make_pip.sh, and remove its packaging files
(setup.py, pyproject.toml, requirements.txt). Nothing else refers to
them by this point in the series, so they can go.
Also fix binman's pyproject.toml, which declares package-data for a
'patman' package (a copy-paste leftover); use 'binman' instead.
Signed-off-by: Simon Glass <[email protected]>
|
|
OP-TEE tee.bin is generated externally and might be missing during the
build.
Signed-off-by: Mathieu Dubois-Briand <[email protected]>
|
|
Boot from FSPI requires additional 448 Byte long header, with U-Boot SPL
starting at offset 0x1000. Currently, both i.MX8MM and i.MX8MN attempt
to generate this header using fspi_conf_block with filename pointing at
CONFIG_FSPI_CONF_FILE file. This does not work, for two reasons.
First, the CONFIG_FSPI_CONF_FILE is generated by mkimage -T imx8mimage
and may not be available yet when the fspi_conf_block is evaluated. That
leads to a race condition where highly parallel builds fail to find the
CONFIG_FSPI_CONF_FILE, which is usually called fspi_header.bin, on first
build attempt.
Second, binman gets confused and patches incorrect offset of DDR PHY
firmware blobs into U-Boot SPL, the offset is incremented by exactly
0x1000 which is the size of fspi_conf_block.
Fix both problems at once, make imx8mimage handle the generated FSPI
header and prepend it in front of the imx8mimage processed data. This
way, the race condition is solved, because the data generated by the
imx8mimage are surely combined only after mkimage -T imx8mimage ran.
The binman offset calculation is also solved, because there is no
fspi_conf_block node in the DT anymore.
Signed-off-by: Marek Vasut <[email protected]>
|
|
Our official domain is now u-boot-project.org, so update all in-tree
references to use the correct domain.
Reviewed-by: Tony Dinh <[email protected]>
Reviewed-by: Peter Robinson <[email protected]>
Signed-off-by: Tom Rini <[email protected]>
|
|
The PKCS#11 signing tests in ftest.py call tools.run('softhsm2-util', ...)
directly (and the equivalent for pkcs11-tool and p11-kit), even though
the test setup has already constructed the corresponding Bintool
instances. As Quentin Schulz observed on v1, the bintool wrapper for
these tools is currently used only as an "is this installed?" probe.
Route the eight remaining call sites in ftest.py through
<bintool>.run_cmd(...), which the Bintool base class already provides.
The change is test-side only; no production binman code calls these
tools.
Suggested-by: Quentin Schulz <[email protected]>
Signed-off-by: Simon Glass <[email protected]>
|
|
The Sphinx-generated bintools.rst currently produces an empty section
for this bintool, since its class docstring is only a single line and
so the body under the heading is blank.
Extend the docstring with a short description of what softhsm2-util
does and how binman uses it, so the generated documentation has useful
content.
Suggested-by: Heinrich Schuchardt <[email protected]>
Signed-off-by: Simon Glass <[email protected]>
|
|
The Sphinx-generated bintools.rst currently produces an empty section
for this bintool, since its class docstring is only a single line and
so the body under the heading is blank.
Extend the docstring with a short description of what pkcs11-tool does
and how binman uses it, so the generated documentation has useful
content.
Suggested-by: Heinrich Schuchardt <[email protected]>
Signed-off-by: Simon Glass <[email protected]>
|
|
The Sphinx-generated bintools.rst currently produces an empty section
for this bintool, since its class docstring is only a single line and
so the body under the heading is blank.
Extend the docstring with a short description of what p11-kit does and
how binman uses it, so the generated documentation has useful content.
Suggested-by: Heinrich Schuchardt <[email protected]>
Signed-off-by: Simon Glass <[email protected]>
|
|
Add a test to verify the preload header correctly signs an encrypted
FIT. This test exercises the case where encryption uses random IVs that
would change between mkimage calls.
Signed-off-by: Paul HENRYS <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
The collection etype uses phandles in the 'content' property to
reference other entries. Mark each referenced entry with build_done
to avoid rebuilding the same entry data multiple times.
This is important for cases where rebuilding may change the data
content, e.g. due to timestamps or random IVs in encryption.
Refactor GetContentsByPhandle() to return both the entry object and
its data.
Signed-off-by: yan wang <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
To optimize preload generation, generate the header and signatures only
after all data has been collected in ProcessContentsUpdate(). This
avoids signing the data multiple times.
Since header_size is known upfront (from __init__), create a placeholder
in `ObtainContents()` to avoid an extra packing pass when
ProcessContentsUpdate() detects a size change.
This reduces unnecessary repacking and signing operations.
Signed-off-by: Paul HENRYS <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
These files are now auto-generated by the binman_docs Sphinx extension
during the doc build, so the committed copies and their symlinks in
doc/develop/package/ are no longer needed.
Update binman.rst to reference the Sphinx extension instead of the
manual generation commands.
Signed-off-by: Simon Glass <[email protected]>
Rebased to apply file deletions cleanly.
Signed-off-by: Heinrich Schuchardt <[email protected]>
|
|
Test pkcs11 URI support for UEFI capsule generation. Both
public certificate and private key are used over pkcs11
protocol.
Pkcs11-tool has been introduced as softhsm tool doesn't have
functionality to import certificates in commonly distributed
version (only in the latest).
Signed-off-by: Wojciech Dubowik <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
Mkeficapsule can dump signature for signed capsules. It can
be used in test to validate signature i.e. with openssl.
Add an entry for device tree node.
Signed-off-by: Wojciech Dubowik <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
It will be used to capsule signature verification.
Signed-off-by: Wojciech Dubowik <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
Only short option has been present. Also rename dump_sig
to dump-sig to match with other parameter names.
Fixes: 16abff246b40 ("tools: mkeficapsule: add firmware image signing")
Signed-off-by: Wojciech Dubowik <[email protected]>
Reviewed-by: Ilias Apalodimas <[email protected]>
|
|
With pkcs11 support in mkeficapsule we can now accept URI
tokens and not only files.
Signed-off-by: Wojciech Dubowik <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
Now that iMX8 has full coverage the allow_failures list in
RunTestCoverage() is no longer needed.
Drop the list.
Signed-off-by: Simon Glass <[email protected]>
|
|
Three files are currently missing test coverage: nxp_imx8mcst,
nxp_imx8mimage and cst
Add test methods to cover all missing code paths, trying to reuse the
same .dts files where possible.
This brings all three files to 100% coverage.
Signed-off-by: Simon Glass <[email protected]>
|
|
Move key.key and key.pem into the security/ subdirectory. These are
used by security, vendor, and capsule tests but security is the most
natural home for key material. Update all references.
Signed-off-by: Simon Glass <[email protected]>
|
|
Move the signing-related test data (keys, certificates, OpenSSL and
SoftHSM2 configuration, dummy engine source) into the fit/ subdirectory
alongside the FIT DTS test files. Drop the 340_ prefix from files that
had it. Update the Makefile and all ftest.py references.
Signed-off-by: Simon Glass <[email protected]>
|
|
Move descriptor.bin, fitimage.bin.gz and ifwi.bin.gz into the x86/
subdirectory alongside the x86 DTS test files and update all
references.
Signed-off-by: Simon Glass <[email protected]>
|
|
Move the remaining 60 or so test files into an entry/ subdirectory.
These cover general entry types and features: entry args, fill, text,
env, compress, replace, template, collection, ELF, overlap, listing,
sections, symlink, TEE OS, and other miscellaneous entries. Drop the
numeric prefixes and update all references.
Signed-off-by: Simon Glass <[email protected]>
Reviewed-by: Quentin Schulz <[email protected]>
|
|
Move about 10 test files for binman symbol patching into a symbols/
subdirectory. Drop the numeric prefixes and the redundant symbols_
filename prefix, and update all references.
Signed-off-by: Simon Glass <[email protected]>
Reviewed-by: Quentin Schulz <[email protected]>
|
|
Move about 20 test files for vendor-specific platform support (TI, NXP
i.MX, Renesas R-Car, Rockchip, PowerPC MPC85xx) into a vendor/
subdirectory. Drop the numeric prefixes and update all references.
Signed-off-by: Simon Glass <[email protected]>
|
|
Move about a dozen test files for UEFI capsule creation (signed,
versioned, accept, revert) into a capsule/ subdirectory. Drop the
numeric prefixes and the redundant capsule_ filename prefix, and
update all references.
Signed-off-by: Simon Glass <[email protected]>
Reviewed-by: Quentin Schulz <[email protected]>
|
|
Move about 15 test files for ARM Trusted Firmware FIP, ATF BL31, SCP,
OpenSBI, and BL1 entries into a fip/ subdirectory. Drop the numeric
prefixes and the redundant fip_ filename prefix, and update all
references.
Signed-off-by: Simon Glass <[email protected]>
|
|
Move about a dozen test files for mkimage entries into a mkimage/
subdirectory. Drop the numeric prefixes and the redundant mkimage_
filename prefix, and update all references.
Signed-off-by: Simon Glass <[email protected]>
Reviewed-by: Quentin Schulz <[email protected]>
|
|
Move about 10 test files for ChromeOS entries (GBB, vblock, FMAP)
into a cros/ subdirectory. Drop the numeric prefixes and update all
references.
Signed-off-by: Simon Glass <[email protected]>
Reviewed-by: Quentin Schulz <[email protected]>
|
|
Move about a dozen test files for Coreboot File System entries into a
cbfs/ subdirectory. Drop the numeric prefixes and the redundant cbfs_
filename prefix, and update all references.
Signed-off-by: Simon Glass <[email protected]>
Reviewed-by: Quentin Schulz <[email protected]>
|
|
Move about 20 test files for signing, encryption, hash, pre-load,
x509, and Xilinx bootgen entries into a security/ subdirectory. Drop
the numeric prefixes and update all references.
Signed-off-by: Simon Glass <[email protected]>
|
|
Move about a dozen test files for blob, blob-ext, blob-ext-list,
fake-blob, and blob-symbol entries into a blob/ subdirectory. Drop
the numeric prefixes and the redundant blob_ filename prefix, and
update all references.
Signed-off-by: Simon Glass <[email protected]>
Reviewed-by: Quentin Schulz <[email protected]>
|
|
Move about 30 test files for FDT update, fdtmap, DTB compression,
alternates, and bootph into an fdt/ subdirectory. Drop the numeric
prefixes and the redundant fdt_ filename prefix, and update all
references.
Remove the unused no_alt_format.dts which has no references in any
test.
Signed-off-by: Simon Glass <[email protected]>
Reviewed-by: Quentin Schulz <[email protected]>
|
|
Move about 40 test files for FIT images (signing, external data,
split-elf, encryption, alignment, firmware loadables, templates) into
a fit/ subdirectory. Drop the numeric prefixes and the redundant fit_
filename prefix, and update all references.
Rename the three signature.dts variants to have unique names:
signature.dts, signature_multi_key.dts and signature_no_nodes.dts.
Signed-off-by: Simon Glass <[email protected]>
|
|
Move about 40 test files for x86 and Intel platform support (ROM,
microcode, ME, IFWI, FSP, descriptor, reset16, start16, FIT) into an
x86/ subdirectory. Drop the numeric prefixes and the redundant x86_
filename prefix, and update all references.
Signed-off-by: Simon Glass <[email protected]>
Reviewed-by: Quentin Schulz <[email protected]>
|
|
Move about a dozen test files for U-Boot image variants (SPL, TPL,
VPL, DTB, nodtb, bss-pad) into an xpl/ subdirectory. Drop the
numeric prefixes and the redundant u_boot_ filename prefix, and
update all references.
Signed-off-by: Simon Glass <[email protected]>
Reviewed-by: Quentin Schulz <[email protected]>
|
